Record deployed personal app and remaining Authelia credential rejection

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680

docs/dev.md

@@ -51,8 +51,8 @@ See `.env.example`. Summary:
 
 ### Platform OIDC (KeyCape)
 
-Historical client registration has drifted: guarded inspection on 2026-10-06
-finds it absent. Inspect through the safe owner wrapper (read-only default):
+The missing historical client registration was restored with founder approval
+on 2026-10-06. Inspect through the safe owner wrapper (read-only default):
 
 ```bash
 ./scripts/register-keycape-client.sh

docs/identity/oidc-client.md

@@ -21,7 +21,7 @@ Non-secret registration checklist for NetKingdom IAM Profile issuers.
 | Environment | Issuer mode | Registered |
 |-------------|-------------|------------|
 | local offline | dev claims (`OIDC_ENABLED=false`) | n/a |
-| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **absent** (guarded inspection 2026-10-06); historically registered 2026-08-09 |
+| platform (railiance01) | KeyCape @ `kc.coulomb.social` | **restored** (founder-approved guarded repair 2026-10-06; interactive acceptance pending) |
 | key-cape dev-config | local compose | yes (repo `config/dev-config.yaml`) |
 
 ### Historical verification (2026-08-09)
@@ -61,3 +61,11 @@ founder approval; the wrapper never restarts the issuer automatically.
 
 See [release review](../release/personal-account-2026-10-06.md) and
 [ordinary-session assurance close-down](../security-close-down-checklist.md).
+
+### Deployed repair — 2026-10-06
+
+Founder approved the exact repair. Guarded CAS/readback succeeded; KeyCape
+restart completed. Discovery returns 200 and authorization hands off to Authelia
+with 302, without the missing-client error. The upgraded app emits the correct
+client ID, callback and S256 PKCE challenge. Interactive tegwick login remains
+pending the user's confirmation. See docs/release/personal-account-deployed-2026-10-06.md.

docs/release/personal-account-2026-10-06.md

@@ -1,8 +1,10 @@
 # Personal Coulomb account release — 2026-10-06
 
-CSOC-WP-0008 · RAPPS-WP-0015 · pending founder decision `8bbce691-a787-4140-9cd4-df06e8635a27`.
-No live mutation has been performed. Prepared code, image and review branch are
-ready; the personal account is not yet usable through this app.
+CSOC-WP-0008 · RAPPS-WP-0015 · founder-approved decision `8bbce691-a787-4140-9cd4-df06e8635a27`.
+The founder approved this proposal and it was deployed as Helm revision 10.
+See [deployment receipt](personal-account-deployed-2026-10-06.md). Interactive
+tegwick sign-in remains pending user confirmation. The sections below preserve
+the reviewed pre-change state and execution proposal.
 
 ## What is running
 
@@ -105,7 +107,7 @@ Bubble exit/apex cutover or real-data import is included in this live approval.
 ## Review artifacts
 
 Application source is committed to coulomb-social main. Deployment changes are on
-railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), pending live go:
+railiance-apps branch csoc-wp-0008-personal-app (RAPPS-WP-0015), approved, merged into main and deployed:
 https://forgejo.coulomb.social/coulomb/railiance-apps/src/branch/csoc-wp-0008-personal-app
 
 Credential owner routing: key-cape-oidc-login; SSH access uses existing routed

docs/release/personal-account-deployed-2026-10-06.md

@@ -0,0 +1,59 @@
+# Personal app deployment receipt — 2026-10-06
+
+Founder explicitly approved: “Go on and deploy the interruption is not a problem.”
+Authority: ADMINISTER @ realm:kubernetes/railiance01, activation=APPROVED.
+Decision 8bbce691-a787-4140-9cd4-df06e8635a27 records that human answer.
+
+## Executed and verified
+
+- Correct node: railiance01 / 92.205.62.239. Preflight CPU requests 3455m/4000m,
+  disk free 123G. Reviewed owner helper hash unchanged; dry-runs/diffs refreshed.
+- Restored only historical public coulomb-social OIDC registration through guarded
+  SSH/CAS owner lane. Secret UID retained; resourceVersion 67716615 → 71471711.
+  Byte-preserving validation/readback confirmed unrelated config and Secret data
+  unchanged. No Secret values or raw errors emitted. Restarted sso/keycape;
+  rollout succeeded. Discovery 200; public /authorize probe 302 to Authelia,
+  without unknown client_id. This is a handoff check, not a completed user login.
+- Fresh Backup databases/csoc-preupgrade-20261006145351 for apps-pg,
+  method barmanObjectStore: completed, start 2026-10-06T14:54:22Z,
+  stop 2026-10-06T14:54:31Z. Completed before app upgrade began.
+- Approved owner chart merged/pushed to railiance-apps main at 3f5a909.
+  Helm upgrade executed from railiance01 with --atomic/--wait/5m timeout.
+  Release coulomb-social revision 10 is deployed, chart 0.2.0, source ac7bac1852c9,
+  digest sha256:bf975939e22b9b0a5d9ac05584ae6265ba201169df6dc48e506ec684b30a9c58.
+- Retained local-path PVC coulomb-social-content is Bound, 2Gi/RWO; mounted at
+  /app/var/content with CONTENT_ROOT matching. One replica/Recreate. App UID/GID
+  10001; volume group 10001; write check passed. A dedicated synthetic marker
+  survived a fresh pod restart and was removed afterward. No real content touched.
+- App 1/1 available after upgrade and restart. Zero pending Django migrations;
+  existing tegwick Member retained (count one for tenant:coulomb and live issuer).
+- Public /healthz and landing: 200. Clipboard JS: 200, 2909 bytes, ClipboardItem
+  present. /auth/login/: 302 to correct issuer/client/callback and PKCE S256.
+  Anonymous /app/: 302, preserving authentication boundary.
+
+## Remaining acceptance
+
+The user has been asked to complete interactive tegwick sign-in. It is not yet
+confirmed. CSOC-WP-0008-T11 remains waiting for that result; T01 continues live
+product smoke/visual and permission acceptance. A DB backup plus persistent
+volume is not paired DB/content restore proof: T02 remains open. Real ReichelAg
+protocol reconciliation/import and manual mail-client paste remain T03/T09.
+No Bubble/apex cutover, real-data import, password change, broad grant or private
+protocol export was performed. RAPPS-WP-0015 remains active pending T04.
+
+## User sign-in result — 2026-10-06
+
+The user reaches auth.coulomb.social but tegwick is rejected as wrong username
+or password. Read-only directory query through the existing provisioner confirms
+tegwick is present. Live Authelia username attribute is uid; its lookup supports
+uid or mail. Contained recent-log inspection records a tegwick LDAP invalid-
+credentials failure, without backend connection error or regulation-ban evidence
+in that entry. This does not establish why the entered credential is rejected.
+
+The app and client restoration are deployed, but personal sign-in is not accepted.
+CSOC-WP-0008-T11 remains wait for human credential confirmation/recovery and a
+successful fresh sign-in. The user was asked whether the same password works on
+another service. No password was requested/read/exported or reset. Authelia's
+current notifier is filesystem rather than SMTP: do not promise emailed recovery
+or expose reset tokens from notification files. Any credential reset must use
+the owning attended recovery/setup lane under a separate exact approved change.

docs/security-close-down-checklist.md

@@ -1,17 +1,17 @@
 # Coulomb sign-in close-down record
 
 2026-10-06 · CSOC-WP-0008-T11 · owners: KeyCape / NetKingdom (authentication)
-and coulomb-social (product assurance). Proposed repair, not yet activated.
+and coulomb-social (product assurance). Founder-approved repair activated on 2026-10-06.
 
 The historical public authorization-code/PKCE client descriptor has
 `mfaRequired: false`: ordinary sessions are AAL1; explicit AAL2 remains supported.
-Restoration would retain that historical policy, with no changes to other clients.
+Restoration retained that historical policy, with no changes to other clients.
 Before production approval, the owners must decide and verify whether ordinary
 personal sessions may remain AAL1, which actions require step-up, and that PKCE,
 exact callbacks and tenant checks are enforced by the running issuer/application.
 Do not treat successful discovery, synthetic tests or a registered Member as
-proof of interactive authentication. The live restoration requires founder go.
+proof of interactive authentication. The founder explicitly approved the live restoration; user sign-in is pending.
 
 Tracking: CSOC-WP-0008-T11 carries restoration and user sign-in evidence;
 CSOC-WP-0008-T04 carries privacy and permission acceptance. Neither is closed by
-preparing this descriptor. No issuer policy has been loosened in this session.
+preparing this descriptor. The restored descriptor preserves the historical AAL1 policy; other clients are unchanged.